Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-32998 |
| Alert Source | Veeam Security Advisory |
| CVE Publication Year | 2026 |
| Date Published | 2026-05-28 |
| Vendor | Veeam |
| Product | Service Provider Console / Backup & Replication |
| Vulnerability Type | Remote Code Execution (RCE) |
| CVSS Score | 9.8 (critical) |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
This vulnerability allows an attacker to remotely execute arbitrary code (RCE) on vulnerable instances of Veeam Service Provider Console and Veeam Backup & Replication. Given the critical role of these platforms in backup management and multi-tenant infrastructure for service providers (MSP/CSP), successful exploitation could significantly impact the security and availability of enterprise data.
Required Actions
Promptly update the vulnerable Veeam products to the latest vendor-supported versions:
- Veeam Service Provider Console — upgrade from 9.x to 9.2.0.33215 or later
- Veeam Backup & Replication — upgrade from 13.x to 13.0.1.2067 or later
Until updates are deployed, restrict network access to Veeam management interfaces to trusted administrative segments only and enforce strong multi-factor authentication (MFA) for all administrative accounts. Monitor event logs for unusual operations on the backup system.
Who Is Affected?
This vulnerability affects:
- Veeam Service Provider Console versions 9.x prior to 9.2.0.33215
- Veeam Backup & Replication versions 13.x prior to 13.0.1.2067
Organizations using Veeam as a central pillar of their backup strategy and managed service providers (MSP/CSP) operating multi-tenant infrastructure are particularly exposed. Compromise of the backup platform is a key vector for ransomware attacks — it allows adversaries to delete or encrypt backups before targeting production systems.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
